Skip to main content

PRTG Alerts with Autotask CI Association

This tutorial walks through building a workflow that processes alert emails from PRTG Network Monitor, looks up the matching Configuration Item (CI) in Autotask by a device identifier, and creates a ticket on that CI's account. If no matching CI is found, a catch-all ticket is created on the zero account so the alert is never lost.

Overview​

PRTG sends alert emails that include a device identifier (such as a probe ID, sensor name, or hostname). The workflow uses the Create Autotask Ticket by Configuration Item action to extract the identifier, match it to a CI in Autotask, and create a ticket in one step. A fallback rule handles alerts that cannot be matched.

Related pages:

Before You Start​

  1. Create a dedicated mailbox for PRTG alerts (for example, [email protected])
  2. Configure PRTG to send alert notifications to this address
  3. Send a few test alerts through so they appear in History, then open them to see the exact email format PRTG produces
  4. Identify the device identifier in the email body (for example, Probe ID:, Sensor:, or Device: followed by a value)
  5. Confirm which field on the Autotask CI stores the matching value (Serial Number, Reference Title, or a User-Defined Field)

Step 1: Create the Rule​

  1. Open your PRTG alerts mailbox and click Add New Rule
  2. Name it Process PRTG Alert
  3. Leave the Expression empty so every email is processed by this rule

Step 2: Add the "Create Ticket by CI" Action​

This action handles identifier extraction, CI lookup, and ticket creation in one step.

  1. Click Add New Action, select Create Autotask Ticket by Configuration Item, click OK
  2. Name the step Create Ticket for PRTG Alert

Configuration - Identifier Extraction:

FieldValue
Identifier SourceUnlock the field, then enter: {{after_string email.body "Probe ID: " flags="tn"}}
If identifier not foundSkip this action

The after_string helper looks for Probe ID: in the email body, captures everything after it up to the next newline (n flag), and trims whitespace (t flag). Adjust the label to match whatever your PRTG emails use (for example, Device: or Sensor: ).

Learn more about text helpers

Configuration - CI Matching:

FieldValue
CI field to matchSelect the Autotask CI field that stores the same value PRTG includes in the email (for example, Serial Number, Reference Title, or a UDF)
If no CI foundSkip this action

Configuration - Ticket Fields:

Populate each required field (fields marked with an asterisk in the UI are required). At minimum:

FieldValue
StatusNew
PrioritySet as appropriate for alert severity
QueueYour monitoring alerts queue
Title{{email.subject}}
Description{{email.body}}

Action When Complete: Set to Stop processing this message completely

Both approaches are valid

This tutorial uses the Create Autotask Ticket by Configuration Item workflow action, which handles extraction, CI lookup, and ticket creation in one step. The Monitoring Alerts Tutorial shows how to build the same pattern using individual API call actions chained together, which gives you more control over each step. Choose whichever approach fits your needs.

Step 3: Add a Catch-All Ticket​

If the CI action is skipped (identifier not found or no matching CI), a fallback action creates a generic ticket so the alert is not lost.

  1. Click Add New Action, select API: Create an Object, click OK
  2. Name the step Create Catch-All Ticket
  3. Set Entity Type to Ticket
  4. Configure the required fields:
FieldValue
AccountIDYour zero account (unlock the field and enter 0)
StatusNew
PriorityMedium
TitleUnmatched PRTG alert: {{email.subject}}
Description{{email.body}}
QueueIDYour monitoring alerts queue

Step 4: Add a Final Stop​

  1. Click Add New Action, select Stop Processing This Message Completely, click OK
  2. Name it Stop

Rule Summary​

The final rule has three actions:

  1. Create Ticket for PRTG Alert (CI action): if the identifier is extracted and the CI is found, creates a ticket on the CI's account and stops the message
  2. Create Catch-All Ticket (API create): only runs if action 1 was skipped; creates a ticket on the zero account
  3. Stop: stops the message so no further rules fire

Test the Workflow​

  1. Replay a PRTG alert email from History (or send a new one)
  2. Open the processing log and verify:
    • The identifier was extracted correctly
    • The CI was found in Autotask (or not, for the catch-all path)
    • A ticket was created on the correct account
  3. Open the ticket in Autotask and confirm the CI is associated

To test the catch-all path, send an email with a device identifier that does not exist in Autotask. Verify the catch-all ticket is created on the zero account.

Key Takeaways​

  • One mailbox per monitoring tool: keep PRTG rules isolated from other workflows
  • Send sample emails first: open them in History to see exactly how Email2AT parsed the email before building extraction logic
  • Always include a catch-all: if the CI action skips, a fallback ticket ensures no alert is lost
  • Choose the right CI field: the field must store the same value that PRTG includes in the alert email
  • Two valid approaches: the CI workflow action handles everything in one step; raw API calls give more control (see Monitoring Alerts Tutorial)